{
  "license": "CC BY 4.0",
  "recipe": {
    "slug": "access-policy-denials",
    "title": "Analyze Access-Policy Denials",
    "testedWith": "Apache DataFusion 45.2.0",
    "lastReviewed": "2026-07-28"
  },
  "contract": {
    "tableName": "authorization_events",
    "schema": [
      {
        "name": "timestamp_utc",
        "type": "Timestamp",
        "description": "Authorization decision time."
      },
      {
        "name": "policy_name",
        "type": "Utf8",
        "description": "Stable policy name and version."
      },
      {
        "name": "action",
        "type": "Utf8",
        "description": "Controlled attempted action."
      },
      {
        "name": "resource_type",
        "type": "Utf8",
        "description": "Resource class without contents."
      },
      {
        "name": "actor_role",
        "type": "Utf8",
        "description": "Bounded actor role."
      },
      {
        "name": "actor_id",
        "type": "Utf8",
        "description": "Restricted privacy-safe actor identifier."
      },
      {
        "name": "outcome",
        "type": "Utf8",
        "description": "allowed or denied."
      }
    ]
  },
  "query": "SELECT\n  policy_name,\n  action,\n  resource_type,\n  actor_role,\n  COUNT(*) AS denied_actions,\n  COUNT(DISTINCT actor_id) AS affected_actors\nFROM authorization_events\nWHERE timestamp_utc >= now() - INTERVAL '7 days'\n  AND outcome = 'denied'\nGROUP BY policy_name, action, resource_type, actor_role\nORDER BY affected_actors DESC, denied_actions DESC;",
  "fixtureKind": "schema-example",
  "inputRows": [
    {
      "timestamp_utc": "2026-07-28T10:00:00Z",
      "policy_name": "policy_name_example_1",
      "action": "action_example_1",
      "resource_type": "resource_type_example_1",
      "actor_role": "actor_role_example_1",
      "actor_id": "actor_id_example_1",
      "outcome": "success"
    },
    {
      "timestamp_utc": "2026-07-28T11:00:00Z",
      "policy_name": "policy_name_example_2",
      "action": "action_example_2",
      "resource_type": "resource_type_example_2",
      "actor_role": "actor_role_example_2",
      "actor_id": "actor_id_example_2",
      "outcome": "failed"
    },
    {
      "timestamp_utc": "2026-07-28T12:00:00Z",
      "policy_name": "policy_name_example_3",
      "action": "action_example_3",
      "resource_type": "resource_type_example_3",
      "actor_role": "actor_role_example_3",
      "actor_id": "actor_id_example_3",
      "outcome": "success"
    }
  ],
  "illustrativeInputRows": [
    {
      "timestamp_utc": "2026-07-28T10:00:00Z",
      "policy_name": "policy_name_example_1",
      "action": "action_example_1",
      "resource_type": "resource_type_example_1",
      "actor_role": "actor_role_example_1",
      "actor_id": "actor_id_example_1",
      "outcome": "success"
    },
    {
      "timestamp_utc": "2026-07-28T11:00:00Z",
      "policy_name": "policy_name_example_2",
      "action": "action_example_2",
      "resource_type": "resource_type_example_2",
      "actor_role": "actor_role_example_2",
      "actor_id": "actor_id_example_2",
      "outcome": "failed"
    },
    {
      "timestamp_utc": "2026-07-28T12:00:00Z",
      "policy_name": "policy_name_example_3",
      "action": "action_example_3",
      "resource_type": "resource_type_example_3",
      "actor_role": "actor_role_example_3",
      "actor_id": "actor_id_example_3",
      "outcome": "success"
    }
  ],
  "expectedOutput": {
    "columns": [
      "policy_name",
      "action",
      "resource_type",
      "actor_role",
      "denied_actions",
      "affected_actors"
    ],
    "rows": [
      {
        "policy_name": "workspace-export-v3",
        "action": "export",
        "resource_type": "workspace",
        "actor_role": "member",
        "denied_actions": 214,
        "affected_actors": 86
      },
      {
        "policy_name": "billing-admin-v2",
        "action": "update",
        "resource_type": "subscription",
        "actor_role": "admin",
        "denied_actions": 48,
        "affected_actors": 31
      }
    ]
  },
  "notes": [
    "The compact input rows demonstrate field names and JSON types; they are not claimed to generate the displayed aggregate by themselves.",
    "The expected output is deterministic synthetic review data for the documented output shape.",
    "Adapt time windows, thresholds, identities, and business definitions before operational use."
  ]
}